Junglewise Threat Intelligence

CVE-2024-35789: Linux Kernel mac80211 use-after-free in VLAN station changes

CVE-2024-35789 · Severity: high · CVSS 7.8 · Published 2024-05-17

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's Wi-Fi stack that could allow a local user to crash the system or potentially execute unauthorized code. The issue occurs when managing virtual local area networks (VLANs) on wireless interfaces, where the system fails to properly clear old data references. This can lead to a system instability or a security breach if the memory is reused after being freed.

Technical details

A use-after-free (UAF) vulnerability exists in the mac80211 wireless stack within the Linux kernel. The root cause is located in the ieee80211_change_station function, where the fast_rx entry may retain a pointer to a VLAN's netdev structure even after the station has been moved and the VLAN deleted. An attacker with local access could exploit this stale pointer to trigger a UAF condition. The fix involves ensuring ieee80211_check_fast_rx is called immediately following a VLAN change to properly clear or update the fast_rx state. Patches have been backported to multiple stable kernel branches.

Affected products

  • Linux Linux Kernel 4.14.232 to 4.15, 4.19.189 to 4.19.312, 5.4.114 to 5.4.274, 5.10.32 to 5.10.215, 5.11.16 to 5.12, 5.12.1 to 5.15.154, 5.16 to 6.1.84, 6.2 to 6.6.24, 6.7 to 6.7.12, 6.8 to 6.8.3

Timeline

  • 2024-03-16: other: Initial patch authored
  • 2024-05-17: disclosed: CVE published

References

Related threats